homeroom/.github/workflows/ci.yml at main · ghzhost/homeroom · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# CI/CD-STANDARD-conformant pipeline: least-privilege GITHUB_TOKEN, SHA-pinned
# actions, and the merge-blocking gates from SECURITY-AND-SUPPLY-CHAIN-STANDARD
# §§4-5 (SAST, secret scan, SCA) plus CODE-QUALITY-STANDARD §2 (`make verify`).
#
# Every action is pinned to the full 40-char commit SHA of its tag, resolved
# 2026-08-07 via `gh api repos/OWNER/REPO/commits/TAG`. Actions stay
# `@<sha> # vX.Y.Z` so the version is human-readable next to the pin, per
# SECURITY-AND-SUPPLY-CHAIN-STANDARD §6.
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          version: ">=0.11.0"
          python-version: "3.12"

      # `make verify` ends in `make pages`, which runs html-validate and axe-core
      # over the school pages built from committed fixtures, in both languages.
      # Nothing is served here and nothing is deployed from this job: both
      # checkers read files off disk. Publication is a separate, deliberate
      # decision; it was made on 2026-08-22, and pages.yml carries it out after
      # this workflow succeeds on main.
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: npm

      - name: make verify (byte-for-byte the local target)
        run: make verify

      - name: the offline page build must produce byte-identical output twice
        run: |
          make site-offline
          find build/site-offline -type f | sort | xargs shasum -a 256 > "${RUNNER_TEMP}/first.txt"
          make site-offline
          find build/site-offline -type f | sort | xargs shasum -a 256 > "${RUNNER_TEMP}/second.txt"
          diff "${RUNNER_TEMP}/first.txt" "${RUNNER_TEMP}/second.txt"

      - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        if: always()
        with:
          files: coverage.xml
          fail_ci_if_error: false

  secret-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sast:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
      - run: uvx --from semgrep==1.168.0 semgrep scan --error --metrics off --config p/python --config p/security-audit .